The Commerce Department inspector general is blasting a federal climate-satellite program and its supporting contractor, Raytheon, for ignoring tens of thousands of major cyber vulnerabilities.

The weaknesses identified in a new IG memo could impair machines controlling the Joint Polar Satellite System, the nation's next-generation fleet of polar orbiting environmental satellites.

The ground system routes information for the National Oceanic and Atmospheric Administration and the Pentagon, as well as other U.S. and foreign government agencies. NOAA, part of Commerce, manages the information technology system.

The system’s critical vulnerabilities have spiked by more than 60 percent since 2012, increasing from 14,486 security holes to 23,868 holes.

High-Risk Vulnerabilities Persist

In 2010, NOAA began modifying the ground system to support satellite upgrades. But, “until 2014, the program did not require the ground system contractor to begin full implementation of the majority of the security controls for the system," Allen Crawley, assistant IG for systems acquisition and IT security, said in the memo. As a result, "many high-risk vulnerabilities exist within the system."

The government increased Raytheon's now-$1.7 billion contract by $185 million in February to strengthen information security and speed data delivery, company officials said at the time.

The "high-risk vulnerabilities" cited by the IG refer to system weaknesses that make it relatively easy for hackers to gain control of computer components.

"If exploited, these vulnerabilities may make it possible for attackers to significantly disrupt the JPSS mission of providing critical data used in weather forecasting and climate monitoring," Crawley said in the memo, which was released Tuesday.

The satellites controlled by the system track data on oceans, ozone, snow, vegetation and other environmental indicators to help scientists discern changes in the Earth's atmosphere.

But hacker tools are already available on the Web to exploit several of the weaknesses, Crawley noted.

The security problems listed include:

More than 9,100 instances of high-risk flaws discovered during vulnerability scans, such as outdated software versions, programs that were missing bug fixes, incorrectly configured software, and excessive user privileges for accessing operating systems and software.

More than 3,600 cases where password and audit settings were misconfigured.

Unnecessary software applications that need to be removed or disabled.

"The majority of these issues will not be remediated for another two years," Crawley said.

The good news is that some of the vulnerabilities could be mended immediately, if NOAA demanded faster response times from Raytheon.

"Urgent updates to the JPSS ground system were not performed because the program did not require that the ground system contractor remediate vulnerabilities in a timely manner," Crawley said.

NOAA Behind in Applying Security Patches

Agency policies mandate that high-risk issues be fixed within 30 days but in practice, patches were only applied about once a year.

NOAA officials told the IG updates were delayed because of the 2011 liftoff of the program's first satellite -- Suomi National Polar-orbiting Partnership -- and an audit of Raytheon's work.

The agency is on schedule for a launch of a second satellite, JPSS-1, in early 2017, NOAA officials said in June.

Among the blunders detailed: a hacker stole satellite data from a contractor's personal computer, after which the employee refused to turn over the machine for investigation. Unauthorized smartphone use on critical systems also turned up during the audit.

IG: Security Concerns Justify Special Attention

On Tuesday, Clark Reid, the Commerce IG's legislative and external affairs officer, said in an email significant security concerns involving the Joint Polar Satellite System ground system "justified special and separate attention” in a new memo.

In written remarks responding to a draft memo, NOAA officials said they already are working to address the IG’s findings by, for example, neutralizing the Heartbleed superbug, a vulnerability in widely-used encryption software.

The agency "successfully used expedited processes to enable remediation of Heartbleed in an accelerated manner" between April and June, Vice Adm. Michael Devany, NOAA deputy undersecretary for operations, said in the July 25 correspondence.

Raytheon officials told Nextgov they had not read the report and referred questions to NOAA. Agency officials Tuesday said they had no additional comment.

FROM OUR SPONSORS

sponsored

JOIN THE DISCUSSION

By using this service you agree not to post material that is obscene, harassing, defamatory, or
otherwise objectionable. Although Nextgov does not monitor comments posted to this site (and has
no obligation to), it reserves the right to delete, edit, or move any material that it deems to
be in violation of this rule.

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

Data-Centric Security vs. Database-Level Security

Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.

PIV- I And Multifactor Authentication: The Best Defense for Federal Government Contractors

This white paper explores NIST SP 800-171 and why compliance is critical to federal government contractors, especially those that work with the Department of Defense, as well as how leveraging PIV-I credentialing with multifactor authentication can be used as a defense against cyberattacks

This research study aims to understand how state and local leaders regard their agency’s innovation efforts and what they are doing to overcome the challenges they face in successfully implementing these efforts.

The U.S. healthcare industry is rapidly moving away from traditional fee-for-service models and towards value-based purchasing that reimburses physicians for quality of care in place of frequency of care.